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DETAILED ACTION 

1 . Claims 1 -40 have been examined. 

Specification 

2. The attempt to incorporate subject matter into this application by reference to 
nonessential subject matter including browser executable code on page 1 line 19 and page 4 line 
7 is improper because browser executable code cannot be incorporated by reference (See MPEP 
§ 608.01(p)(I)(A)). 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

4. Claims 1-10, 12-28, and 30-36 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over "Coverability Analysis Using Symblic Model Checking" published by IBM (hereinafter 
"IBM") in view of the "Background of the Invention" section found on pages 1-13 of the 
originally filed specification (hereinafter "BOTT'). 

In regard to claim 1, IBM discloses: 

A method for performing coverability analysis in software, See IBM page 1 : 
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Every coverage model has a corresponding coverability model. A coverability model is 
defined by creating, for every coverage event indicator in coverage model, a coverability 
event indicator which is binary function on the state-machine model The coverability 
event indicator is true if there exists a test on the state-machine model for which the 
corresponding coverage event indicator is true. 
comprising: 

formulating respective coverability tasks for the dominating blocks of the SUT; 
See IBM bottom of page 1 : 

First, as described above, a coverage model is in fact composed of coverage event 
indicators, each of which is mappable to a corresponding coverability indicator. 
generating rules regarding behavior of the SUT corresponding respectively to the 
coverability tasks; See IBM bottom of page 1 - top of page 2: 

The second observation is that a state-machine model can be instrumented with control 
variables and related transitions which, on one hand, retain the original model behavior as 
reflected on the original state variables, and, on the other hand, can be used for 
coverability analysis of the model. The analysis is carried out by formulating special 
rules on the instrumented model, and presenting these rules (with the instrumented 
model) to a Symbolic Model Checker. 
for each of the rules, running a symbolic model checker to test a behavioral 

model of the SUT, so as to produce respective results for the rules; See IBM top of page 

2 as cited above: 

The analysis is carried out by formulating special rules on the instrumented model, and 
presenting these rules (with the instrumented model) to a Symbolic Model Checker. 
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computing a coverability metric for the SUT responsive to the results and the 

coverability tasks. See IBM top of page 1 : 

. . .it is shown how a number of coverability metrics, corresponding to some commonly- 
used coverage metrics (statement, multi-condition), can be implemented via Symbolic 
Model Checking (1). 

IBM does not expressly disclose performing a static analysis of software under test 

(SUT) so as to identify a plurality of dominating blocks in the SUT', 

However, in an analogous environment, BOTI teaches performing a static 

analysis of software under test (SUT) so as to identify a plurality of dominating blocks in 

the SUT (BOTI: page 11 line 11 - page 12 line6: 

As noted earlier, some optimizations in model checking borrow concepts from 
compiler theory. These concepts are known in the art, and include a basic block-a set of 
one or more statements within the same control-flow construct. Another useful, related 
concept is that of dominating blocks, including pre-dominating and post-dominating 
blocks. 

Also Fig. 4 and associated text on page 12 lines 17-29 teaches dominating blocks. 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to use BOTI's teaching of dominating blocks with IBM's 
coverability tool. One of ordinary skill would have been motivated to analyze source 
code to identify dominating blocks in order to perform computational optimizations to 
reduce the amount of time spent analyzing a model. 

In regard to claim 2, the above rejection of claim 1 is incorporated. IBM does not 
expressly disclose: writing the SUT in a programming language adapted to define at 
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least one of a group of elements comprising a software element and a hardware element. 
However, BOTI teaches on page 4 lines 25-29 of the originally filed specification of the 
incorporated reference "Symbolic Model Checking without BDDs" by Biere et al. 
(hereinafter "Biere"). Further review of Biere reveals the use of the "SMV language" in 
Section 6. This leads to the reference "Symbolic Model Checking" by McMillan 
(hereinafter "McMillan") which defines the SMV language in Chapter 3. Since the SMV 
language is implemented as a software programming language, it inherently provides for 
software elements. McMillan then goes on to use the software elements in terms of 
hardware in Chapter 4. As such, it also defines hardware elements. It would have been 
obvious to one of ordinary skill in the art at the time the invention was made to use 
BOTFs teaching of SMV with IBM's model checker. One of ordinary skill would have 
been motivated to provide a symbolic description of the transition relation of a finite 
Kripke structure in order to provide a great deal of flexibility. 

In regard to claim 3, the above rejection of claim 1 is incorporated. IBM does not 
expressly disclose: wherein performing the static analysis of the SUT comprises: 
identifying a set of dominating blocks in the SUT; and solving a subset cover problem on 
the set of dominating blocks so as to identify the plurality of dominating blocks. 
However, BOTI teaches solving a subset cover problem on page 13 lines 3-11. It would 
have been obvious to one of ordinary skill in the art at the time the invention was made to 
use BOTFs teaching of a subset cover problem with IBM's model checker. One of 
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ordinary skill would have been motivated to use an efficient algorithm that solves the 
subset cover problem in order to save execution time. 



In regard to claim 4, the above rejection of claim 3 is incorporated. IBM does not 
expressly disclose: wherein the set of dominating blocks comprises a set of all 
dominating blocks in the SUT, and wherein the plurality of dominating blocks comprises 
fewer blocks than the set of all dominating blocks in the SUT However, BOTI teaches a 
subset of dominating blocks on page 13 line 5. It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to use BOTI's teaching of a 
subset of dominating blocks with IBM's model checker. One of ordinary skill would 
have been motivated to reduce the computation space in order to reduce execution time. 

In regard to claim 5, the above rejection of claim 4 is incorporated. IBM does not 
expressly disclose: wherein running the symbolic model checker comprises performing a 
number of executions of the symbolic model checker smaller than a total number of all 
the dominating blocks in the SUT However, by the definition and example given in 
BOTI page 13 lines 17-21, the Greedy Algorithm "selects a block with the largest set of 
dominated blocks, constructs a list of covered blocks, and repeats until the list of covered 
blocks contains each block in the SUT." This results in a smaller number of "executions" 
than blocks. It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to use BOTFs teaching of the Greedy Algorithm with IBM's model 
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checker. One of ordinary skill would have been motivated to reduce the computation 
space in order to reduce execution time. 

In regard to claim 6, the above rejection of claim 1 is incorporated. IBM further 
discloses: wherein formulating the respective coverability tasks for the dominating blocks 
of the SUT comprises formulating coverability tasks by at least one of a group of methods 
comprising manual formulation and automatic formulation. See IBM: "mappable to a 
corresponding coverability indicator." Mapping must be either manual or automatic, 
there are no there options. 

In regard to claim 7, the above rejection of claim 1 is incorporated. IBM further 
discloses: wherein generating the rules regarding behavior of the SUT comprises 
generating rules by at least one of a group of methods comprising manual generation and 
automatic generation. See IBM: "formulating special rules on the instrumented 
model. . .". Formulation must be either manual or automatic, there are no other options. 

In regard to claim 8, the above rejection of claim 1 is incorporated. IBM further 
discloses: wherein running the symbolic model checker to test the behavioral model of 
the SUT comprises: evaluating the respective results so as to determine the truth or 
falsity of the rule; and generating a list of uncoverable elements responsive to the 
respective results. See IBM: "The coverability event indicator is true if there exists a test 
on the state-machine model for which the corresponding coverage event indicator is true. 
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In regard to claim 9, the above rejection of claim 1 is incorporated. IBM further 
discloses: wherein generating the rules regarding behavior of the SUT corresponding 
respectively to the coverability tasks comprises instrumenting the SUT by adding one or 
more statements and one or more auxiliary variables thereto, so as to facilitate 
evaluation of the rules. IBM page 2: "formulating special rules on the instrumented 
model"; also "adding a counter after every statement and initializing it to zero." 

In regard to claim 10, the above rejection of claim 9 is incorporated. IBM further 
discloses: wherein instrumenting the SUT comprises: determining a plurality of basic 
blocks comprised in the SUT; and for each basic block: defining an auxiliary variable for 
the block; initializing the auxiliary variable to zero; and assigning the auxiliary variable 
a non-zero value upon execution of the basic block. IBM page 2: "initializing it to zero. . . 
some of the counters are modified". 

In regard to claim 12, the above rejection of claim 1 is incorporated. IBM further 
discloses: wherein computing the coverability metric comprises: evaluating an attained 
coverability responsive to the respective results produced by running the symbolic model 
checker; evaluating an unattained coverability responsive to the respective results 
produced by running the symbolic model checker; performing a comparison between the 
attained coverability and the coverability tasks; calculating the coverability metric 
responsive to the comparison; and analyzing the behavioral model of the SUT with 
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respect to the unattained cover ability. IBM page 2: "... a warning on the existence of 
dead-code is created for every statement that cannot be reached." This implies evaluation 
of attained and unattained coverability. Also "Automatically determining which of the 
coverage event indicators correspond to coverable events." This requires comparison and 
analysis of the behavioral model, otherwise the model checker could not determine what 
corresponds to what. 

In regard to claim 13, the above rejection of claim 1 is incorporated. IBM further 
discloses: analyzing a design of the SUT, responsive to the coverability metric, for at 
least one of a group of properties comprising dead code, unattainable states, uncoverable 
statements, uncoverable states, unattainable transitions, unattainable variable values, 
and unreachable conditions. IBM page 2: "... a warning on the existence of dead-code is 
created for every statement that cannot be reached." 

In regard to claim 14, IBM does not expressly disclose applying a testing strategy 
chosen from one of a group of strategies comprising excluding uncoverable elements 
from coverage measurements, setting coverage goals responsive to the coverability 
metric, and determining a criterion for stopping testing responsive to the coverability 
metric. However, BOTI teaches at least setting coverage goals on page 2 lines 3-29. It 
would have been obvious to one of ordinary skill in the art at the time the invention was 
made to use BOTI's teaching of coverage goals with IBM's coverability tool. One of 



Application/Control Number: 10/003,482 Page 10 

Art Unit: 2122 

ordinary skill would have been motivated to set coverage goals in order to attain a well- 
defined level of success. 

In regard to claim 15, the above rejection of claim 14 is incorporated. IBM 
further discloses: wherein the uncoverable elements comprise one or more elements 
chosen from a group of elements comprising uncoverable statements, uncoverable states, 
unattainable transitions, unattainable variable values, and unreachable conditions. IBM 
page 1: "statement, multi-condition... define-use, mutation, and loop"; also page 2: "a 
warning on the existence of dead-code is created for every statement that cannot be 
reached." 

In regard to claim 16, the above rejection of claim 1 is incorporated. IBM further 
discloses: wherein formulating the respective coverability tasks for the dominating blocks 
of the SUT comprises: identifying a coverage model for the SUT; defining a coverability 
model for the SUT responsive to the coverage model; and generating the respective 
coverability tasks responsive to the coverability model. IBM page 1 : "a coverage model 
is in fact composed of coverage event indicators, each of which is mappable to a 
corresponding coverability indicator." 

In regard to claim 17, IBM does not expressly disclose a second coverability task, 
an inflator, an inflated result, or evaluating a second coverability task responsive to the 
inflated result. However, BOTI teaches: 
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running a symbolic model checker comprising an inflator to test a behavioral 

model of the SUT responsive to the rule so as to produce an inflated result; See BOTI 

page 6 lines 26-29: 

Symbolic model checker system 56 contains an optional inflator 64 which expands the 
scope of the model checker output, as described in more detail below, with reference to 
FIG. 3 

evaluating the second coverability task responsive to the inflated result. See BOTI 

page 7 lines 22-28: 

Inflator 64 provides a way to include additional variables in the trace in result 80, by 
generating plausible values for additional variables. Inflator 64 sets input variables to 
random values, and computes values for additional values based on the random input 
variables and the contents of the counter-example. 
All further limitations have been addressed in the above rejection of claim 1. 

It would have been obvious to one of ordinary skill in the art at the time the 

invention was made to use BOTFs teaching of using an inflator with IBM's model 

checker. One of ordinary skill would have been motivated to introduce additional 

random variables into a system to overcome the variable space reduction introduced by 

the cone of influence optimization. 

In regard to claim 18, the above rejection of claim 17 is incorporated. IBM does 
not expressly disclose: wherein formulating the second coverability task comprises 
choosing a plurality of coverability tasks from a set of all coverability tasks for the SUT, 
and wherein evaluating the second coverability task comprises evaluating the plurality. 
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However, BOTI teaches on page 7 lines 25-28 that an inflator computes values based on 
random input variables and the contents of the counter-example. This result is fed back 
and executed until all coverable tasks have been examined. It would have been obvious 
to one of ordinary skill in the art at the time the invention was made to use BOTFs 
teaching of an inflator with IBM's model checker. One of ordinary skill would have been 
motivated to exhaust the computation space until all possible tasks have been evaluated. 

In regard to claims 19, 21-28, 31-34, and 36, the above rejection of claim 17 is 
incorporated. All further limitations have been addressed in the above rejections of 
claims 3, 4, 5, 2, and 6-10, and 12-16, respectively. 

In regard to claim 20, the above rejection of claim 19 is incorporated. IBM does 
not expressly disclose: wherein selecting the first cover ability task comprises: identifying 
a greatest-influence dominating block having a largest set of dominated blocks 
comprised in the plurality; and selecting the first coverability task responsive to the 
greatest-influence dominating block However, BOTI teaches the "Greedy Algorithm" 
on page 13 lines 17-21 for identifying optimal coverability tasks. It would have been 
obvious to one of ordinary skill in the art at the time the invention was made to use 
BOTFs teaching of the Greedy Algorithm with IBM's model checker. One of ordinary 
skill would have been motivated to reduce the computation space of the model in order to 
reduce execution time. 
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In regard to claim 30, the above rejection of 17 is incorporated. IBM does not 
expressly disclose: wherein running the symbolic model checker comprises producing the 
inflated result regardless of the truth or falsity of the rule. However, BOTI teaches 
inflation on page 7 lines 6-29, without regard to whether a rule is true or false. An 
inflator finds values outside of the cone of influence regardless of the value of any 
particular rule. 

In regard to claim 35, the above rejection of claim 35 is incorporated. IBM does 
not expressly disclose: performing a plurality of executions of an inflator program so as 
to produce a plurality of inflated results; and evaluating the second coverability task 
responsive to the plurality of inflated results. However, BOTI teaches on page 7 lines 
22-29 that an inflator is useful for obtaining a plurality of values outside the cone of 
influence. It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to use BOTTs teaching of inflators with IBM's model checker. One 
of ordinary skill would have been motivated to repeat the execution of an inflator in order 
to obtain additional results that lie outside the cone of influence. 



5. Claims 1 1 and 29 are rejected under 35 U.S.C. 103(a) as being unpatentable over the 
combination of IBM and BOTI as applied to claims 1 above, and further in view of U.S. Patent 
5,579,515 to Hintz et al. (hereinafter "Hintz"). 
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In regard to claim 1 1, the above rejection of claim 9 is incorporated. The 
combination of IBM and BOTI do not expressly disclose: determining a plurality of basic 
blocks comprised in the SUT; defining a single auxiliary variable for the SUT; 
initializing the single auxiliary variable to zero; and assigning a unique non-zero value 
to the single auxiliary variable upon execution of each basic block. However, in an 
analogous environment, Hintz teaches in column 3 lines 20-25 that a variable can be used 
to uniquely identify separate logical entities. It would have been obvious to one of 
ordinary skill in the art at the time the invention was made to use Hintz's teaching of 
unique non-zero entities in IBM's coverability tool. One of ordinary skill would have 
been motivated to uniquely identify an executed block in order to determine the coverage 
status of the block. 

In regard to claim 29, the above rejection of claim 27 is incorporated. All further 
limitations have been addressed in the above rejection of claim 11. 

6. Claims 37-40 are rejected under 35 U.S.C. 103(a) as being unpatentable over the 
combination of IBM and BOTI, and further in view of U.S. Patent 6,484,134 to Hoskote 
(hereinafter "Hoskote"). 

In regard to claims 37 and 38, YYY does not expressly disclose an apparatus. 
However, in an analogous environment, Hoskote teaches such an apparatus in Fig. 1 and 
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column 3 lines 18-57. All further limitations have been addressed in the above rejection 
of claims 1 and 17, respectively. 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to use Hoskote's apparatus with YYY's method. One of ordinary 
skill would have been motivated to implement a method on an apparatus that can 
efficiently carry out the method. 



In regard to claims 39 and 40, YYY does not expressly disclose a computer 
software product. However, Hoskote teaches such a product in claim 3 lines 48-64. All 
further limitations have been addressed in the above rejection of claims 1 and 17, 
respectively. 

It would have been obvious to one of ordinary skill in the art at the time the 
invention was made to use Hoskote's software product with YYY's method. One of 
ordinary skill would have been motivated to store instructions for a method for easy 
distribution and archival. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to J. Derek Rutten whose telephone number is (571) 272-3703. The 
examiner can normally be reached on M-F 6:30-3:00. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tuan Q. Dam can be reached on (571) 272-3695. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC).at 866-217-9197 (toll-free). 
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